An identical rsyncd.conf and rsync client command works Linux-to-Linux, though in that case it's xinetd not inetd. I'm wondering if there is something BSD-specific?

Given that error, looks to me like the client can talk to port 873 (and pf has not been setup yet), so I don't think it's a firewall issue. I also took out the hosts allow line and it didn't make a difference.